CVE-2026-40906

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40906

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40906.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40906

Aliases

GHSA-h5rg-pxx7-r2hj

Published

2026-04-21T20:05:51.819Z

Modified

2026-07-16T03:31:04.034028714Z

Severity

9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Electric: SQL Injection via ORDER BY Parameter in Shape API

Details

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40906.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/electric-sql/electric

Affected ranges

Type

GIT

Repo

https://github.com/electric-sql/electric

Events

Introduced

87dd51941282f75c9704900dc199f642b2ec8461

Fixed

9864c0b85284d0acc37188608f925d0cdb4ddb23

Database specific

{
    "cpe": "cpe:2.3:a:electric:sync-service:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.1.12"
        },
        {
            "fixed": "1.5.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

@core/electric-telemetry@0.*

@core/electric-telemetry@0.1.1

@core/electric-telemetry@0.1.2

@core/electric-telemetry@0.1.3

@core/elixir-client@0.*

@core/elixir-client@0.7.3

@core/elixir-client@0.8.0

@core/elixir-client@0.8.1

@core/elixir-client@0.8.2

@core/elixir-client@0.8.3

@core/sync-service@1.*

@core/sync-service@1.1.12

@core/sync-service@1.1.13

@core/sync-service@1.1.14

@core/sync-service@1.2.0

@core/sync-service@1.2.1

@core/sync-service@1.2.10

@core/sync-service@1.2.11

@core/sync-service@1.2.2

@core/sync-service@1.2.3

@core/sync-service@1.2.4

@core/sync-service@1.2.5

@core/sync-service@1.2.6

@core/sync-service@1.2.7

@core/sync-service@1.2.8

@core/sync-service@1.2.9

@core/sync-service@1.3.0

@core/sync-service@1.3.1

@core/sync-service@1.3.2

@core/sync-service@1.3.3

@core/sync-service@1.3.4

@electric-sql/client@1.*

@electric-sql/client@1.0.11

@electric-sql/client@1.0.12

@electric-sql/client@1.0.13

@electric-sql/client@1.0.14

@electric-sql/client@1.1.0

@electric-sql/client@1.1.1

@electric-sql/client@1.1.2

@electric-sql/client@1.1.3

@electric-sql/client@1.1.4

@electric-sql/client@1.1.5

@electric-sql/client@1.2.0

@electric-sql/client@1.2.1

@electric-sql/client@1.2.2

@electric-sql/client@1.3.0

@electric-sql/client@1.3.1

@electric-sql/client@1.4.0

@electric-sql/client@1.4.1

@electric-sql/client@1.4.2

@electric-sql/docs@0.*

@electric-sql/docs@0.0.3

@electric-sql/docs@0.0.4

@electric-sql/experimental@1.*

@electric-sql/experimental@1.0.11

@electric-sql/experimental@1.0.12

@electric-sql/experimental@1.0.13

@electric-sql/experimental@1.0.14

@electric-sql/experimental@2.*

@electric-sql/experimental@2.0.0

@electric-sql/experimental@2.0.1

@electric-sql/experimental@2.0.2

@electric-sql/experimental@2.0.3

@electric-sql/experimental@2.0.4

@electric-sql/experimental@2.0.5

@electric-sql/experimental@3.*

@electric-sql/experimental@3.0.0

@electric-sql/experimental@3.0.1

@electric-sql/experimental@3.0.2

@electric-sql/experimental@4.*

@electric-sql/experimental@4.0.0

@electric-sql/experimental@4.0.1

@electric-sql/experimental@5.*

@electric-sql/experimental@5.0.0

@electric-sql/experimental@5.0.1

@electric-sql/experimental@5.0.2

@electric-sql/react@1.*

@electric-sql/react@1.0.11

@electric-sql/react@1.0.12

@electric-sql/react@1.0.13

@electric-sql/react@1.0.14

@electric-sql/react@1.0.15

@electric-sql/react@1.0.16

@electric-sql/react@1.0.17

@electric-sql/react@1.0.18

@electric-sql/react@1.0.19

@electric-sql/react@1.0.20

@electric-sql/react@1.0.21

@electric-sql/react@1.0.22

@electric-sql/react@1.0.23

@electric-sql/react@1.0.24

@electric-sql/react@1.0.25

@electric-sql/react@1.0.26

@electric-sql/react@1.0.27

@electric-sql/react@1.0.28

@electric-sql/start@1.*

@electric-sql/start@1.0.0

@electric-sql/start@1.0.1

@electric-sql/start@1.0.2

@electric-sql/start@1.0.3

@electric-sql/y-electric@0.*

@electric-sql/y-electric@0.1.10

@electric-sql/y-electric@0.1.11

@electric-sql/y-electric@0.1.12

@electric-sql/y-electric@0.1.13

@electric-sql/y-electric@0.1.14

@electric-sql/y-electric@0.1.15

@electric-sql/y-electric@0.1.16

@electric-sql/y-electric@0.1.17

@electric-sql/y-electric@0.1.18

@electric-sql/y-electric@0.1.19

@electric-sql/y-electric@0.1.20

@electric-sql/y-electric@0.1.21

@electric-sql/y-electric@0.1.22

@electric-sql/y-electric@0.1.23

@electric-sql/y-electric@0.1.24

@electric-sql/y-electric@0.1.25

@electric-sql/y-electric@0.1.8

@electric-sql/y-electric@0.1.9

tanstack-start-db-electric-starter@0.*

tanstack-start-db-electric-starter@0.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40906.json"